Texas Instruments Serial Programming Adapter MSP430 User manual

Application ReportSLAA089D – December 1999 – Revised August 2006
Features of the MSP430 Bootstrap LoaderStefan Schauer..................................................................................................................... MSP430
ABSTRACT
The MSP430 bootstrap loader (BSL) enables users to communicate with embeddedmemory in the MSP430 microcontroller during the prototyping phase, final production,and in service. Both the programmable memory (flash memory) and the data memory(RAM) can be modified as required.
The commonly used UART protocol with RS232 interfacing is supported, allowingflexible use of both hardware and software.
To use the bootstrap loader, a specific BSL entry sequence has to be applied tospecific device pins. An added sequence of commands initiates the desired function. Aboot-loading session can be exited by continuing operation at a defined user programaddress or by the reset condition.
Access to the MSP430 memory via the bootstrap loader is protected against misuse bya user-defined password.
Contents1 Introduction .......................................................................................... 22 Standard RESET and BSL Entry Sequence .................................................... 23 UART Protocol ...................................................................................... 34 Synchronization Sequence ........................................................................ 45 Commands .......................................................................................... 46 Programming Flow ................................................................................. 47 Data Frame .......................................................................................... 58 Loadable BSL ...................................................................................... 129 Exiting the BSL .................................................................................... 1210 Password Protection .............................................................................. 1211 Code Protection Fuse ............................................................................ 1312 BSL Internal Settings and Resources .......................................................... 1313 Special Consideration for BSL Version 1.10 .................................................. 1514 References ......................................................................................... 15Appendix A Differences Between Devices and BSL Versions ................................... 16Appendix B MSP430 BSL Replicator ................................................................ 23
SLAA089D – December 1999 – Revised August 2006 Features of the MSP430 Bootstrap Loader 1Submit Documentation Feedback

www.ti.com
1 Introduction
2 Standard RESET and BSL Entry Sequence
2.1 MSP430 20- and 28-Pin Flash Devices With Shared JTAG Pins
RST
DTR
/NMI
( )
TEST
( )RTS User Program Starts
Bootstrap Loader Starts
RST
DTR
/NMI
( )
TEST
( )RTS
Introduction
This bootstrap loader (BSL) provides a method to program the flash memory during MSP430 projectdevelopment and updates. It can be activated by a utility that sends commands via the familiar UARTprotocol. The BSL enables the user to control the activity of the MSP430 and to exchange data using apersonal computer or other device that supports a UART protocol.
To avoid accidental overwriting of the BSL code, this code is stored in a special factory-masked bootROM. The BSL cannot ever be erased. The BSL code is highly optimized for the BSL function and isaccessed using commands described later in this document. For security purposes and to preventunwanted source readout, user code protection is very important. Any BSL command that directly orindirectly allows data reading is password protected.
To invoke the bootstrap loader, a BSL entry sequence has to be applied to dedicated pins. After that, asynchronization character, followed by the data frame of a specific command, initiates the desiredfunction.
Applying an appropriate entry sequence on the RST/NMI and TEST pins forces the MSP430 to startprogram execution at the BSL RESET vector instead of at the RESET vector located at address FFFEh.
If the application interfaces with a computer UART, these two pins may be driven by the DTR and RTSsignals of the serial communication port (RS232) after passing level shifters. Detailed descriptions of thehardware and related considerations are given in a separate document (see Section 14 References). Thenormal user reset vector at FFFEh is used, if TEST is kept low while RST/NMI rises from low to high(standard method, see Figure 1 ).
Figure 1. Standard RESET Sequence
The BSL program execution starts whenever the TEST pin has received a minimum of two positivetransitions and if TEST is high while RST/NMI rises from low to high (BSL entry method, see Figure 2 ).This level/transition triggering improves BSL startup reliability.
Figure 2. BSL Entry Sequence at Shared JTAG Pins
2Features of the MSP430 Bootstrap Loader SLAA089D – December 1999 – Revised August 2006Submit Documentation Feedback

www.ti.com
2.2 MSP430 Flash Devices With Dedicated JTAG Pins
RST
DTR
/NMI
( )
TEST
( )RTS Bootstrap Loader Starts
3 UART Protocol
UART Protocol
The TEST signal is normally used simply to switch the port pins P1.7 to P1.4 between their applicationfunction and the JTAG function. If the second rising edge at the TEST pin is applied while RST/NMI is stilllow, the TEST signal is kept low internally (application mode).
The BSL will not be started (via the BSL RESET vector), if:•There are less than two positive edges at the TEST pin while RST/NMI is low•TEST is low when RST/NMI rises from low to high•JTAG has control over the MSP430 resources•Supply voltage, V
CC
, drops down and a power-on reset (POR) is executed•RST/NMI pin is configured for NMI functionality (NMI bit is set)
Note: The minimum timing for this sequence must be within the limits specified for thecorresponding pin in the datasheet.
Devices with dedicated JTAG pins use the TCK pin instead of the TEST pin.
The BSL program execution starts whenever the TCK pin has received a minimum of two negativetransitions and TCK is low while RST/NMI rises from low to high (BSL entry method, see Figure 3 ). Thislevel/transition triggering improves BSL start-up reliability.
Figure 3. BSL Entry Sequence at Dedicated JTAG Pins
Note: The minimum timing for this sequence has to be within the limits specified for thecorresponding pin in the datasheet.
The BSL will not be started (via the BSL RESET vector), if:•There are less than two negative edges at TCK pin while RST/NMI is low•TCK is high if RST/NMI rises from low to high•JTAG has control over the MSP430 resources•Supply voltage, V
CC
, drops down, and a power-on reset (POR) is executed•RST/NMI pin is configured for NMI functionality (NMI bit is set)
The UART protocol applied here is defined as:•Baud rate is fixed to 9600 baud in half duplex mode (one sender at a time).•Start bit, 8 data bits (LSB first), an even parity bit, 1 stop bit.•Handshake is performed by an acknowledge character.•Minimum time delay before sending new characters after characters have been received from theMSP430 BSL: 1.2 ms
Note: Applying baud rates other than 9600 baud at initialization results in communicationproblems or violates the flash memory write timing specification. The flash memory maybe extensively stressed or may react with unreliable program/erase operations.
SLAA089D – December 1999 – Revised August 2006 Features of the MSP430 Bootstrap Loader 3Submit Documentation Feedback

www.ti.com
4 Synchronization Sequence
5 Commands
5.1 Unprotected Commands
5.2 Password Protected Commands
6 Programming Flow
Synchronization Sequence
Before sending any command to the BSL, a synchronization character (SYNC) with its value of 80h has tobe sent to the BSL. This character is necessary to calculate all the essential internal parameters, whichmaintain UART and flash memory program/erase timings. It provides the BSL system time reference.Once this is received, an acknowledge DATA_ACK = 90h is sent back by the BSL to confirm successfulreception.
This sequence must be done before every command that is sent to the BSL.
Note: The synchronization character is not part of the Data Frame described later.
Two categories of commands are available: commands that require a password and commands that donot require a password. The password protection safeguards every command that potentially allows director indirect data access.
•Receive password•Mass erase (erase entire flash memory, main as well as information memory)•Transmit BSL version (V1.60 or higher or in loadable BL_150S_14x.txt)•Change baud rate (V1.60 or V1.61 or in loadable BL_150S_14x.txt)
•Receive data block to program flash memory, RAM, or peripherals•Transmit data block•Erase segment•Erase check (V1.60 or higher or in loadable BL_150S_14x.txt)•Set Memory Offset (V2.12)•Load program counter and start user program•Change baud rate (moved to a protected command starting with BSL version 2.01)
The write access (RX data block command) to the flash memory/RAM or peripheral modules area isexecuted online. That means a data byte/word is processed immediately after receipt and the write cycleis finished before a following byte/word has completely arrived. Therefore, the entire write time isdetermined by the baud rate, and no buffering mechanism is necessary.
Data sections located below the flash memory area address are assumed to be loaded into the RAM orperipheral module area and, thus, no specific flash control bits are affected.
Note: When losing control over the UART protocol, either by line faults or by violating the dataframe conventions, the only way to recover is to rerun the BSL entry sequence to initiateanother BSL session.
Features of the MSP430 Bootstrap Loader4 SLAA089D – December 1999 – Revised August 2006Submit Documentation Feedback

www.ti.com
7 Data Frame
7.1 Data-Stream Structure
Data Frame
To get high data security during the data transmission, a data frame protocol called serial standardprotocol (SSP) is used. The BSL is considered the receiver in Table 1 .
For more information on serial standard protocol (SSP), see the TI application report, Application ofBootstrap Loader in MSP430 With Flash Hardware and Software Proposal, literature number SLAA096.
•The first 8 bytes (HDR through LH) are mandatory (xx represents dummy data).•Data bytes D1 to Dn are optional.•Two bytes (CKL and CKH) for checksum are mandatory.•Acknowledge done by the BSL is mandatory, except with the TX data block and TX BSL versioncommands.
Table 1. Data Frame of BSL Commands
(1) (2) (3) (4) (5)
Received
BSL HDR CMD L1 L2 AL AH LL LH D1 D2 …Dn CKL CKH ACKCommand
RX data block 80 12 n n AL AH n–4 0 D1 D2 …Dn–4 CKL CKH ACKRX password 80 10 24 24 xx xx xx xx D1 D2 …D20 CKL CKH ACKErase segment 80 16 04 04 AL AH 02 A5 – – – – CKL CKH ACKErase main or info 80 16 04 04 AL AH 04 A5 – – – – CKL CKH ACKMass erase 80 18 04 04 xx xx xx xx – – – – CKL CKH ACKErase check 80 1C 04 04 AL AH LL LH – – – – CKL CKH ACKChange baud rate 80 20 04 04 D1 D2 D3 xx – – – – CKL CKH ACKSet mem offset 80 21 04 04 AL AH xx xx – – – – CKL CKH ACKLoad PC 80 1A 04 04 AL AH xx xx – – – – CKL CKH ACKTX data block 80 14 04 04 AL AH n 0 – – – – CKL CKH –BSL responds 80 xx n n D1 D2 ... ... …... …Dn CKL CKH –TX BSL version 80 1E 04 04 xx xx xx xx – – – – CKL CKH –BSL responds 80 xx 10 10 D1 D2 ... ... … … … D10 CKL CKH –
(1)
All numbers are bytes in hexadecimal notation.(2)
ACK is sent back by the BSL.(3)
The synchronization sequence is not part of the data frame.(4)
The erase check and TX BSL version commands are not members of the standard command set (V1.50 or higher).(5)
The change baud rate command is not a member of the standard command set (V1.60 or higher or in loadableBL_150S_14x.txt).
SLAA089D – December 1999 – Revised August 2006 Features of the MSP430 Bootstrap Loader 5Submit Documentation Feedback

www.ti.com
7.2 Checksum
7.3 Example Sequence
Data Frame
Abbreviations:
HDR Header: Any value between 80h and 8Fh (normally 80h).CMD Command identificationL1, L2 Number of bytes consisting of AL through DnRestrictions: L1 = L2, L1 < 255, L1 evenAL, AH Block start address or erase (check) address or jump address LO/HI byteLL, LH Number of pure data bytes (250 max) or erase information LO/HI byte or block length oferase check (FFFFh max)D1 …Dn Data bytesCKL, CKH 16-bit checksum LO/HI bytexx Can be any data-- No character (data byte) received/transmittedACK The acknowledge character returned by the BSL. Can be either DATA_ACK = 90h: Framewas received correctly, command was executed successfully, or DATA_NAK = A0h: Framenot valid (e.g., wrong checksum, L1 ≠L2), command is not defined, is not allowed, or wasexecuted unsuccessfully.nNumber of bytes consisting of AL through Dn
The 16-bit (2 bytes) checksum is calculated over all received/transmitted bytes B1 ... Bn in the data frame,except the checksum bytes themselves, by XORing words (2 successive bytes) and inverting the result.
This means that B1 is always the HDR byte and Bn is the last data byte just before the CKL byte.
Formula –CHECKSUM = INV [ (B1 + 256 ×B2) XOR (B3 + 256 ×B4) XOR …XOR (Bn – 1 + 256 ×Bn) ]or
CKL = INV [ B1 XOR B3 XOR …XOR Bn–1 ]CKH = INV [ B2 XOR B4 XOR …XOR Bn ]
The following example shows a request to read the memory of the MSP430 from location 0x0F00. Allvalues shown below are represented in hexadecimal format.
TO BSL: 80
(Sych character sent to the BSL)FROM BSL: 90
(Acknowledge from BSL)TO BSL: 80 14 04 04 F0 0F 0E 00 85 E0(Send Command to read memory from 0x0F00, length 0x000E)FROM BSL: 80 00 0E 0E F2 13 40 40 00 00 00 00 00 00 02 01 01 01 C0 A2(Returned values from BSL)
Features of the MSP430 Bootstrap Loader6 SLAA089D – December 1999 – Revised August 2006Submit Documentation Feedback

www.ti.com
7.4 Commands – Detailed Description
7.4.1 General
7.4.2 RX Data Block
7.4.3 RX Password
Data Frame
See Table 1 .
Besides the header byte HDR (80h) and the command identification CMD, the frame length bytes L1 andL2 (which must be equal) hold the number of bytes following L2, excluding the checksum bytes CKL andCKH.
Bytes AL, AH, LL, LH, D1...Dn are command-specific. However, the checksum bytes CKL (low byte) andCKH (high byte) are mandatory.
If the data frame has been received correctly and the command execution was successful, anacknowledge character DATA_ACK = 90h is sent back by the BSL. Incorrectly received data frames,unsuccessful operations, and commands that are locked or not defined are confirmed with a DATA_NAK =A0h.
Note: BSL versions lower than V1.30 support only byte access operations. Therefore, theperipheral module addresses at 0100h–01FFh cannot be accessed correctly, becausethey are word-oriented. From version V1.30 and up, addresses 0000h–00FFh areaccessed in byte mode; all others are accessed in word mode.
The receive data block command is used for any write access to the flash memory/RAM or peripheralmodule control registers at 0000h–01FFh. It is password protected.
The 16-bit even-numbered block start address is defined in AL (low byte) and AH (high byte). The 16-biteven-numbered block length is defined in LL (low byte) and LH (high byte). Because pure data bytes arelimited to a maximum of 250, LH is always 0.
The following data bytes are succeeded by the checksum bytes CKL (low byte) and CKH (high byte). Ifthe receipt and programming of the appropriate data block was successful, an acknowledge characterDATA_ACK is sent back by the BSL. Otherwise, the BSL confirms with a DATA_NAK.
Note: BSL versions V1.40 and higher support online verification inside the MSP430 foraddresses 0200h–FFFFh, which reduces programming/verification time to 50%. Onlineverification means that the data is immediately verified with the data that is written into theflash without transmitting it again. In case of an error, the loadable bootstrap loaderBL_150S_14x.txt additionally stores the first incorrectly written location address+3 into theerror address buffer in the RAM at address 0200h (021Eh for F14x devices).
The receive password command is used to unlock the password-protected commands, which performreading, writing, or segment-erasing memory access. It is not password protected.
Neither start address nor block length information is necessary, because the 32-byte password is alwayslocated at addresses FFE0h–FFFFh. Data bytes D1 to D20h hold the password information starting withD1 at address FFE0h.
If the receipt and verification of the password is correct, a positive acknowledge DATA_ACK is sent backby the BSL, and the password-protected commands become unlocked. Otherwise the BSL confirms with aDATA_NAK.
Once the protected commands become unlocked, they remain unlocked until another BSL entry isinitiated.
SLAA089D – December 1999 – Revised August 2006 Features of the MSP430 Bootstrap Loader 7Submit Documentation Feedback

www.ti.com
7.4.4 Mass Erase
7.4.5 Erase Segment
Data Frame
The mass erase command erases the entire flash memory area (main memory plus information memory,see corresponding data sheet). It is not password protected.
All parameters shown in Table 1 are mandatory. After erasing, an acknowledge character DATA_ACK issent back by the BSL.
Mass erase initializes the password area to 32 times 0FFh.
Note: BSL versions V2.01 and higher support automatic clearing of the LOCKA bit protectinginformation flash memory. When the BSL is entered from a rest condition, LOCKA iscleared by the BSL in order to mass erase the flash, including information memory. Whenthe BSL is entered in-application, user software should take care that LOCKA = 1 prior toinitiating the BSL. Otherwise, information flash will not be erased during a BSL masserase.
The erase segment command erases specific flash memory segments. It is password protected.
The address bytes AL (low byte) and AH (high byte) select the appropriate segment. Any even-numberedaddress within the segment to be erased is valid. After segment erasing, an acknowledge characterDATA_ACK is sent back by the BSL (V1.40 or lower).
BSL versions V1.60 or higher perform a subsequent erase check of the corresponding segment andrespond with a DATA_NAK if the erasure was not successful. In this case, the first unerased locationaddress + 1 is stored in the error address buffer in the RAM at address 0200h (021Eh for F14x devices).In this version, a problem occurs if only one of the information memory segments is erased. In this case,an error is reported, because an automatic erase check over the whole information memory is performed.As a solution, either erase the whole information memory or do a separate erase check after the erase,even if the erase reported an error.
Erase segment 0 clears the password area and, therefore, the remaining password is 32 times 0FFh.
When applying LL = 0x04 and LH = 0xA5, a mass erasure of only the main memory is performed. Indeed,this command must be executed a minimum of 12 times to achieve a total erasure time of >200 ms. Nosubsequent erase check of the entire main memory is done. Use the erase check command additionally.Check the device datasheet for more information on the cumulative (mass) erase time that must be metand the number of erase cycles required.
8Features of the MSP430 Bootstrap Loader SLAA089D – December 1999 – Revised August 2006Submit Documentation Feedback

www.ti.com
7.4.6 Erase Check
7.4.7 Change Baud Rate
Data Frame
The MSP430F1xxx and MSP430F4xxx device segmentation is configured as follows:
0FE00h–0FFFFh : Segment 0 Main memory0FC00h–0FDFFh : Segment 10FA00h–0FBFFh : Segment 20F800h–0F9FFh : Segment 3...
01200h–013FFh : Segment n-101100h–011FFh : Segment n01080h–010FFh : Segment A01000h–0107Fh : Segment B Information memory
The MSP430F2xxx device segmentation is configured as follows:
0FE00h–0FFFFh : Segment 0 Main memory0FC00h–0FDFFh : Segment 10FA00h–0FBFFh : Segment 20F800h–0F9FFh : Segment 3...
01200h–013FFh : Segment n-101100h–011FFh : Segment n010C0h–010FFh : Segment A Information memory01080h–010BFh : Segment B01040h–0107Fh : Segment C01000h–0103Fh : Segment D
The erase check command verifies the erasure of flash memory within a certain address range. It ispassword protected.
The 16-bit block start address is defined in AL (low byte) and AH (high byte). The 16-bit block length isdefined in LL (low byte) and LH (high byte). Both can be either even or odd numbered to allow oddboundary checking.
If the erase check of the appropriate data block was successful (all bytes contain 0FFh), an acknowledgecharacter DATA_ACK is sent back by the BSL. Otherwise, the BSL confirms with a DATA_NAK and thefirst non-erased location address + 1 is stored in the error address buffer at address 0200h (021Eh forF14x devices).
Note: This command is not a member of the standard command set. It is implemented in BSLversion V1.60 and higher or in the loadable bootstrap loader BL_150S_14x.txt.
The change baud rate command offers the capability of transmissions at higher baud rates than thedefault 9600 baud. With faster data transition, shorter programming cycles can be achieved, which isespecially important with large flash memory devices. This command is not password protected.
SLAA089D – December 1999 – Revised August 2006 Features of the MSP430 Bootstrap Loader 9Submit Documentation Feedback

www.ti.com
Data Frame
Three control bytes (D1 to D3) determine the selected baud rate. D1 and D2 set the processor frequency(f ≥f
min
), D3 indirectly sets the flash timing generator frequency (f
FTGmin
≤f
FTG
≤f
FTGmax
). In detail:
D1: F1xx: Basic clock module control register DCOCTL (DCO.2 ... DCO.0)F2xx: Basic clock module control register DCOCTL (DCO.2 ... DCO.0)F4xx: FLL+ system clock control register SCFI0 (D, FN_8 ... FN_2)D2: F1xx: basic clock module control register BCSCTL1 (XT2Off, Rsel.2 ... Rsel.0)F2xx: basic clock module control register BCSCTL1 (XT2Off, Rsel.2 ... Rsel.0)F4xx: FLL+ system clock control register SCFI1 (N
DCO
)D3 0: 9600 Baud1: 19200 Baud2: 38400 Baud
After receiving the data frame, an acknowledge character DATA_ACK is sent back, and the BSL becomesprepared for the selected baud rate. It is recommended for the BSL communication program to waitapproximately 10 ms between baud rate alteration and succeeding data transmission to give the BSLclock system time for stabilization.
Note: The highest achievable baud rate depends on various system and environmentparameters like supply voltage, temperature range, and minimum/maximum processorfrequency. See the corresponding device specification/data sheet.
Note: This command is implemented on BSL versions V1.60 or higher or available in theloadable bootstrap loader BL_150S_14x.txt.
Table 2. Recommendations for MSP430F149 [F449]
(1)
(T
A
= 25 °C, V
CC
= 3.0 V, f
max
= 6.7 MHz)
PROCESSOR PROGRAM/VERIFYBAUD RATE D1 DCOCTL D2 BCSCTL1FREQUENCY, f
min
D3
(3)
60 Kbytes(Baud) [SCFI0]
(3)
[SCFI1]
(3)(MHz)
(2)
(sec)
(4)
9600 (init) 1.05 0x80 [00] 0x85 [98] 00 [00] 78 + 3.7 [0.0]19200 2.1 0xE0 [00] 0x86 [B0] 01 [01] 39 + 3.7 [2.4]38400 4.2 0xE0 [00] 0x87 [C8] 02 [02] 20 + 3.7 [2.4]
(1)
Values in brackets [ ] are related to MSP430F449.(2)
The minimum processor frequency is lower than in the standard ROM BSL (see Section 12.3 , Initialization Status).(3)
D1 to D3 are bytes in hexadecimal notation.(4)
Additional 3.7 [2.4] seconds result from loading, verifying, and launching the loadable BSL.
Table 3. Recommendations for MSP430F2131
(1)
(T
A
= 25 °C, V
CC
= 3.0 V, f
max
= 6.7 MHz)
PROCESSOR PROGRAM/VERIFYBAUD RATE D1 DCOCTL D2 BCSCTL1FREQUENCY, f
min
D3
(3)
60 Kbytes(Baud) [SCFI0]
(3)
[SCFI1]
(3)(MHz)
(2)
(sec)
9600 (init) 1.05 0x80 0x85 00 7819200 2.1 0x00 0x8B 01 3938400 4.2 0x80 0x8C 02 20
(1)
Values in brackets [ ] are related to MSP430F449.(2)
The minimum processor frequency is lower than in the standard ROM BSL (see Section 12.3 , Initialization Status).(3)
D1 to D3 are bytes in hexadecimal notation.
Features of the MSP430 Bootstrap Loader10 SLAA089D – December 1999 – Revised August 2006Submit Documentation Feedback